Athen Labs

Applied Security Research

Start an engagement

Boutique security engineering for software, infrastructure, and protocols, with focused expertise across Web2 and Web3.

Research portfolio

ShopifyWeb & API security

AmmalgamSmart contracts

SuperformSmart contracts

MezoProtocol security

KilnWeb & infrastructure

AaveSmart contracts

BinanceWallet-signing security

HubSpotApplication security

ShopifyWeb & API security

AmmalgamSmart contracts

SuperformSmart contracts

MezoProtocol security

KilnWeb & infrastructure

AaveSmart contracts

BinanceWallet-signing security

HubSpotApplication security

Recent works

Shopify

Session integrity failure, weakened credential trust, OAuth boundary crossing, and diverged webhook trust Session integrity failure Host validation weakened credential trust OAuth state crossed session boundaries Authentication and webhook trust diverged Session integrity failure Host validation weakened credential trust OAuth state crossed session boundaries Authentication and webhook trust diverged Session integrity failure Host validation weakened credential trust OAuth state crossed session boundaries Authentication and webhook trust diverged Session integrity failure Host validation weakened credential trust OAuth state crossed session boundaries Authentication and webhook trust diverged Session integrity failure Host validation weakened credential trust OAuth state crossed session boundaries Authentication and webhook trust diverged Session integrity failure

2026

HubSpot

Object-level authorization bypass

2026

Binance

Unintended wallet-signing behavior

2026

Ammalgam

Unsafe contract state, protocol invariant violation, and inconsistent market accounting Contract logic reached an unsafe state Protocol invariant violation Market accounting produced inconsistent results Contract logic reached an unsafe state Protocol invariant violation Market accounting produced inconsistent results Contract logic reached an unsafe state Protocol invariant violation Market accounting produced inconsistent results Contract logic reached an unsafe state Protocol invariant violation Market accounting produced inconsistent results Contract logic reached an unsafe state

2026

Superform

Contract execution diverged from expectations

2026

Mezo

Protocol trust assumptions failed

2026

Kiln

Web infrastructure exposed an unsafe trust path

2026

Aave V3

Unexpected Aptos contract state and protocol behavior outside expected invariants Aptos contract logic reached an unexpected state Protocol behavior violated expected invariants Aptos contract logic reached an unexpected state Protocol behavior violated expected invariants Aptos contract logic reached an unexpected state Protocol behavior violated expected invariants Aptos contract logic reached an unexpected state

2026

Boston-based security research firm helping teams secure applications, infrastructure, and decentralized protocols.

hello@athenlabs.com

Research portfolio

Recent works

© 2026 Athen Labs, LLC